Cisco Systems 4500 Supported Features That Use ACLs, Router ACLs

47-3
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 47 Configuring Network Security with ACLs About ACLs
The Catalyst 4500 series switch supports three types of ACLs:
• IP ACLs, which filter IP traffic, including TCP , the User Datagr am Protocol ( UDP) , Int ernet Gr oup
Management Protocol (IGMP), and Internet Control Message Protocol (ICMP).
• IPv6 ACLs (applies only to Supervisor Engine 6E).
• MAC ACLs which match based on Ethernet addresses and Ether Type.
Supported Features That Use ACLs
The switch supports two applications of ACLs to filter traffic:
• Router ACLs are applied to Layer 3 interfaces. They control the access of routed traffic between
VLANs. All Catalyst 4500 series switches can create router ACLs, but you must have a Cisco IOS
software image on your switch to apply an ACL to a Layer 3 interface and filter packets routed
between VLANs.
• Port ACLs perform access control on traffic entering a Layer 2 interface. If insufficient hardware
CAM entries exist, the output port ACL is not applied to the port and a warning message is given to
user. (This restriction applies to all access group modes for output port ACLs.) When sufficient
CAM entries exist, the output port ACL may be reapplied.
If there is any output port ACL configured on a Layer 2 port, then no VACL or router ACL can be
configured on the VLANs that the Layer 2 port belongs to. Also, the reverse is true: port ACLs and
VLAN-based ACLs (VACLs and router ACLs) are mutually exclusive on a Layer 2 port. This
restriction applies to all access group modes. On the input direction, port ACLs, VLAN-based
ACLs, and router ACLs can co-exist.
You can apply one IPv4 access list, one IPv6 access list and one MAC access list for a Layer 2
interface.
• VLAN ACLs or VLAN maps control the access of all packets (bridged and routed). You can use
VLAN maps to filter traffic between devices in the same VLAN. You do not need the enhanced
image to create or apply VLAN maps. VLAN maps are configured to control access based on
Layer 3 addresses for IP. MAC addresses using Ethernet ACEs control the access of unsupported
protocols. After you apply a VLAN map to a VLAN, all packets (routed or bridged) entering the
VLAN are checked against that map. Packets can either enter the VLAN through a switch port or
through a routed port after being routed.
You can use both router ACLs and VLAN maps on the same switch.
Router ACLs
You can apply one access list of each supported type to an interface.
Note Catalyst 4500 series switches running Cisco IOS Release 12.2(40)SG do not support IPv6 port ACLs
(PACLs).
Multiple features can use one ACL for a given interface, and one feature can use multiple ACLs. When
a single router ACL is used by multiple features, it is examined multiple times. The access list type
determines the input to the matching operation:
• Standard IP access lists use source addresses for matching operations.